---
id: "GHSA-8g28-rj54-p5p2"
kind: "vulnerability"
aliases: ["GHSA-8g28-rj54-p5p2"]
title: "CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-assistants", "ai-tooling", "aws", "lab-disclosure", "mcp", "security-agent-mcp-server", "self-hosted"]
not_affected_if: ["not-running-mcp-server", "version-0.2.0-or-later"]
published_at: null
first_seen_at: "2026-10-24T19:43:43+00:00"
updated_at: "2026-10-25T04:50:13+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/", "first_seen_at": "2026-10-24T19:43:43+00:00"}]
---

# CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

An argument injection in the diff scan operation of AWS's security-agent-mcp-server MCP server lets a crafted reference value be parsed as a command-line option instead of a revision. An attacker can create, overwrite, or truncate arbitrary files on the host outside the intended workspace.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of security-agent-mcp-server; versions `>= 0.1.1` and `< 0.2.0` are affected.
- Find where the server runs and whether it accepts diff scan requests from untrusted input.

## Fix

- Upgrade security-agent-mcp-server to `0.2.0` or later.
- Patch any forked or derivative code with the fixes included in `0.2.0`.
- Until upgraded, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment.

## Timeline

- 2026-10-24T19:43:43+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/ — AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

## Documents

- [advisory] AWS: CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan https://aws.amazon.com/security/security-bulletins/rss/2026-121-aws/

## From the sources

CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

### CVE-2026-97662 - Argument injection in AWS security-agent-mcp-server diff scan

Bulletin ID: 2026-121-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 10/01/2026 10:30 AM PDT

Description:

security-agent-mcp-server is an open-source Model Context Protocol (MCP) server, published by AWS in the awslabs/mcp repository, that AI assistants use to run local security scans (including differential "diff" scans) over source code. We identified CVE-2026-97662, an argument injection issue in the diff scan operation: a crafted reference value supplied to the scan is interpreted as a command-line option rather than a revision, which lets a context-dependent actor create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory, bypassing the server's workspace-confinement control.

Impacted versions: >= 0.1.1 AND < 0.2.0

Resolution:

This issue has been addressed in security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

There is no workaround other than upgrading. Until you upgrade, run diff scans only against trusted repositories, and run the server as a least-privileged user in an isolated environment so a stray write cannot reach sensitive host files.

References:

- CVE-2026-97662
- GHSA-8g28-rj54-p5p2

Acknowledgement:

We would like to thank Mario Guzmán (yud4s), independent researcher for collaborating on this issue through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns..

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_